Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-4242

Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation.

Published

2010-01-25T19:30:01.090

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	realnetworks	realplayer	10.0	Yes
Application	realnetworks	realplayer	10.5	Yes
Application	realnetworks	realplayer	11.0	Yes
Application	realnetworks	realplayer	11.0.1	Yes
Application	realnetworks	realplayer	11.0.2	Yes
Application	realnetworks	realplayer	11.0.3	Yes
Application	realnetworks	realplayer	11.0.4	Yes
Application	realnetworks	realplayer	11.0.5	Yes
Application	realnetworks	realplayer_enterprise	*	Yes
Application	realnetworks	realplayer_sp	1.0.0	Yes
Application	realnetworks	realplayer_sp	1.0.1	Yes
Operating System	microsoft	windows	*	No
Application	realnetworks	realplayer	10.0	Yes
Application	realnetworks	realplayer	10.1	Yes
Application	realnetworks	realplayer	11.0	Yes
Application	realnetworks	realplayer	11.0.1	Yes
Operating System	apple	mac_os_x	*	No
Application	realnetworks	helix_player	10.0	Yes
Application	realnetworks	helix_player	11.0.0	Yes
Application	realnetworks	helix_player	11.0.1	Yes
Application	realnetworks	realplayer	10.0	Yes
Application	realnetworks	realplayer	11.0.0	Yes
Application	realnetworks	realplayer	11.0.1	Yes

References

http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.html ([email protected])
http://osvdb.org/61966 ([email protected])
http://secunia.com/advisories/38218 Vendor Advisory ([email protected])
http://secunia.com/advisories/38450 ([email protected])
http://securitytracker.com/id?1023489 Patch ([email protected])
http://service.real.com/realplayer/security/01192010_player/en/ Patch, Vendor Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2010-0094.html ([email protected])
http://www.securityfocus.com/archive/1/509096/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/37880 ([email protected])
http://www.vupen.com/english/advisories/2010/0178 Patch, Vendor Advisory ([email protected])
http://www.zerodayinitiative.com/advisories/ZDI-10-006/ Patch ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=561436 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/55795 ([email protected])
https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.8 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144 ([email protected])
http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.html (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/61966 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38218 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38450 (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1023489 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://service.real.com/realplayer/security/01192010_player/en/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2010-0094.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/509096/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/37880 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/0178 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.zerodayinitiative.com/advisories/ZDI-10-006/ Patch (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=561436 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/55795 (af854a3a-2127-422b-91ae-364da2661108)
https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.8 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144 (af854a3a-2127-422b-91ae-364da2661108)